Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[receiver/splunkhecreceiver] Updates Splunk receiver http status codes in order to be compliant with SplunkCloud #14469

Merged
merged 4 commits into from
Sep 28, 2022

Conversation

pantuza
Copy link
Contributor

@pantuza pantuza commented Sep 24, 2022

Description:
TL;DR
This Pull Request makes Splunk receiver returns the same HTTP Status code as Splunk Cloud service

Problem:
SplunkCloud returns 200 OK when you send requests to /{raw/events} HTTP routes.
Splunk receiver in the other hand returns 202 Accepted. Based on that, consider a scenario
where you are migrating from sending logs to SplunkCloud directly and starting to add one
Open Telemetry Splunk Receiver in between in order to modify data before proceeding towards SplunkCloud.

The observed side effects were that all clients stopped working because the response Status Code
was different from SplunkCloud itself. Thus, such migration wouldn't be transparent.

Link to tracking Issue: N/A

Testing:
No new tests were added. Although, all previous tests were updated to use StatusOK on its assertions.

Documentation:
I didn't find any documentation regarding returning statuses codes for this particular receiver.

Examples

Event sent to Splunk Cloud directly

$> curl -v -X POST 'https://{SplunkCloudDNS}/services/collector/event' -H 'Authorization: Splunk {TOKEN}' -d '{data}'
< HTTP/1.1 200 OK
< Content-Type: application/json; charset=UTF-8
< Date: Sat, 24 Sep 2022 19:39:22 GMT
< Server: Splunkd
< Vary: Authorization
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< Content-Length: 27
< Connection: keep-alive 

Same event sent to Splunk Receiver

$> curl -v -X POST 'https://{SplunkReceiverDNS}/services/collector/event' -H 'Authorization: Splunk {TOKEN}' -d '{data}'
< HTTP/1.1 202 Accepted
< date: Sat, 24 Sep 2022 19:44:36 GMT
< content-length: 4
< content-type: text/plain; charset=utf-8
< x-envoy-upstream-service-time: 11
< server: istio-envoy

@pantuza pantuza requested review from a team and djaglowski September 24, 2022 19:49
@atoulme
Copy link
Contributor

atoulme commented Sep 26, 2022

This is a good fix. I verified on the latest Splunk Enterprise as well and it does conform to replying with 200 status codes now.

@dmitryax
Copy link
Member

@pantuza please add a changelog entry

@bogdandrutu bogdandrutu added the ready to merge Code review completed; ready to merge by maintainers label Sep 28, 2022
@bogdandrutu bogdandrutu merged commit d3cc2dd into open-telemetry:main Sep 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ready to merge Code review completed; ready to merge by maintainers
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants